Python
by Python (programming language)
Source repositories
CVEs (183)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-50649 | 0.00 | — | 0.01 | Nov 15, 2024 | The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability. | |||
| CVE-2024-50650 | 0.00 | — | 0.01 | Nov 15, 2024 | python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter. | |||
| CVE-2024-9287 | 0.00 | — | 0.01 | Oct 22, 2024 | A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This… | |||
| CVE-2024-6232 | 0.00 | — | 0.02 | Sep 3, 2024 | There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives. | |||
| CVE-2024-7592 | 0.00 | — | 0.02 | Aug 19, 2024 | There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting… | |||
| CVE-2023-6507 | 0.00 | — | 0.01 | Dec 8, 2023 | An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not… | |||
| CVE-2023-40217 | 0.00 | — | 0.01 | Aug 25, 2023 | An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket… | |||
| CVE-2023-41105 | 0.00 | — | 0.02 | Aug 23, 2023 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security… | |||
| CVE-2022-48560 | 0.00 | — | 0.02 | Aug 22, 2023 | A use-after-free exists in Python through 3.9 via heappushpop in heapq. | |||
| CVE-2022-48566 | 0.00 | — | 0.01 | Aug 22, 2023 | An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. | |||
| CVE-2022-48564 | 0.00 | — | 0.01 | Aug 22, 2023 | read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format. | |||
| CVE-2023-38898 | 0.00 | — | 0.01 | Aug 15, 2023 | An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there… | |||
| CVE-2023-36632 | 0.00 | — | 0.02 | Jun 25, 2023 | The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data… | |||
| CVE-2023-33595 | 0.00 | — | 0.00 | Jun 7, 2023 | CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c. | |||
| CVE-2022-45061 | 0.00 | — | 0.02 | Nov 9, 2022 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service.… | |||
| CVE-2022-44049 | 0.00 | — | 0.01 | Nov 7, 2022 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-grammars package. The affected version of d8s-htm is 0.1.0. | |||
| CVE-2022-42919 | 0.00 | — | 0.01 | Nov 6, 2022 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same… | |||
| CVE-2020-10735 | 0.00 | — | 0.03 | Sep 9, 2022 | A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases… | |||
| CVE-2021-28861 | 0.00 | — | 0.02 | Aug 23, 2022 | Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html… | |||
| CVE-2022-31516 | 0.00 | — | 0.01 | Jul 11, 2022 | The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
- CVE-2024-50649Nov 15, 2024risk 0.00cvss —epss 0.01
The user avatar upload function in python_book V1.0 has an arbitrary file upload vulnerability.
- CVE-2024-50650Nov 15, 2024risk 0.00cvss —epss 0.01
python_book V1.0 is vulnerable to Incorrect Access Control, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter.
- CVE-2024-9287Oct 22, 2024risk 0.00cvss —epss 0.01
A vulnerability has been found in the CPython `venv` module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts (ie "source venv/bin/activate"). This…
- CVE-2024-6232Sep 3, 2024risk 0.00cvss —epss 0.02
There is a MEDIUM severity vulnerability affecting CPython. Regular expressions that allowed excessive backtracking during tarfile.TarFile header parsing are vulnerable to ReDoS via specifically-crafted tar archives.
- CVE-2024-7592Aug 19, 2024risk 0.00cvss —epss 0.02
There is a LOW severity vulnerability affecting CPython, specifically the 'http.cookies' standard library module. When parsing cookies that contained backslashes for quoted characters in the cookie value, the parser would use an algorithm with quadratic complexity, resulting…
- CVE-2023-6507Dec 8, 2023risk 0.00cvss —epss 0.01
An issue was found in CPython 3.12.0 `subprocess` module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the `extra_groups=` parameter with an empty list as a value (ie `extra_groups=[]`) the logic regressed to not…
- CVE-2023-40217Aug 25, 2023risk 0.00cvss —epss 0.01
An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5. It primarily affects servers (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket…
- CVE-2023-41105Aug 23, 2023risk 0.00cvss —epss 0.02
An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security…
- CVE-2022-48560Aug 22, 2023risk 0.00cvss —epss 0.02
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
- CVE-2022-48566Aug 22, 2023risk 0.00cvss —epss 0.01
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
- CVE-2022-48564Aug 22, 2023risk 0.00cvss —epss 0.01
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
- CVE-2023-38898Aug 15, 2023risk 0.00cvss —epss 0.01
An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component. NOTE: this is disputed by the vendor because (1) neither 3.7 nor any other release is affected (it is a bug in some 3.12 pre-releases); (2) there…
- CVE-2023-36632Jun 25, 2023risk 0.00cvss —epss 0.02
The legacy email.utils.parseaddr function in Python through 3.11.4 allows attackers to trigger "RecursionError: maximum recursion depth exceeded while calling a Python object" via a crafted argument. This argument is plausibly an untrusted value from an application's input data…
- CVE-2023-33595Jun 7, 2023risk 0.00cvss —epss 0.00
CPython v3.12.0 alpha 7 was discovered to contain a heap use-after-free via the function ascii_decode at /Objects/unicodeobject.c.
- CVE-2022-45061Nov 9, 2022risk 0.00cvss —epss 0.02
An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service.…
- CVE-2022-44049Nov 7, 2022risk 0.00cvss —epss 0.01
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-grammars package. The affected version of d8s-htm is 0.1.0.
- CVE-2022-42919Nov 6, 2022risk 0.00cvss —epss 0.01
Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing library, when used with the forkserver start method on Linux, allows pickles to be deserialized from any user in the same…
- CVE-2020-10735Sep 9, 2022risk 0.00cvss —epss 0.03
A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int("text"), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases…
- CVE-2021-28861Aug 23, 2022risk 0.00cvss —epss 0.02
Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure. NOTE: this is disputed by a third party because the http.server.html…
- CVE-2022-31516Jul 11, 2022risk 0.00cvss —epss 0.01
The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Page 6 of 10